Week in review: Password-less security, WPA3 design flaws, new Windows 10 update controls
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0211 | Use-After-Free Root Local Privilege Escalation in Apache HTTP Server 2.4 In Apache HTTP Server 2.4 releases 2.4.17 through 2.4.38, a use-after-free flaw (CWE-416) in scoreboard handling allows code running in less-privileged child processes or threads — including in-process scripting interpreters such as mod_php — to execute arbitrary code with the privileges of the parent process, which is usually root. All three standard multi-processing modules (event, worker, and prefork) are affected on Unix-like systems; non-Unix systems such as Windows are not affected. An attacker who can already run code inside the web server process, for example a shared-hosting customer running PHP, gains root privileges on the host, putting every site and service on that server at risk. The flaw is rated 7.8 (high), a public proof-of-concept exploit known as 'Carpe Diem' has been released, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild; EPSS puts the 30-day exploitation probability at 65% (99th percentile). Public scans reported in news coverage counted more than 2 million Apache HTTP servers running affected versions, with shared web hosting environments highlighted as most at risk. Do: Upgrade Apache HTTP Server to a fixed release (2.4.39 or later) or apply patched packages from your OS/vendor — Apache, Fedora, Canonical/Ubuntu, Debian, openSUSE, NetApp, Red Hat, and Oracle have shipped fixes — as required by the CISA KEV catalog. Prioritize internet-facing and shared-hosting servers that run in-process scripting such as mod_php, and verify the running version (e.g. 'apachectl -v' or 'httpd -v') is outside the 2.4.17–2.4.38 range. Note that Windows and other non-Unix installations are not affected. | 7.8 | 65% | KEV PoC ×2 |
| mass≈2,000,000+ Apache HTTP servers running affected 2.4.17–2.4.38 releases (subset requiring local code-execution access, e.g. shared hosts) | |
| CVE-2019-1573 | GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end- GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN session and gain access as the user. NVD description · AI analysis pending | 2.5 | <1% |
| — |
Full article912 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news and articles:
Magento sites under attack through easily exploitable SQLi flaw
A recently patched SQL injection flaw affecting the popular open-source e-commerce platform Magento is being actively exploited by attackers, so if you haven’t implemented the provided security update or patch, now is the time to do it.
What hackers inside your company are after: Convenience
Digital transformation is not a technology trend. Rather, it is a convenience trend. Businesses are changing because customer expectations demand it. Each day, consumers find yet another use for mobile connectivity. Corporations, meanwhile, hasten the rush of data into the cloud. And the so-called Internet of Things, or IoT, is woven more tightly into the fabric of our lives.
77% of orgs lack a cybersecurity incident response plan
Of the organizations surveyed that do have a plan in place, more than half (54%) do not test their plans regularly.
A quarter of phishing emails bypass Office 365 security
Email phishing is one of the most often used – and most successfully used – attack vectors that lead to cybersecurity incidents and breaches.
Securing your app and driving down call center fraud
In this Help Net Security podcast, Angie White, Product Marketing Manager at iovation, talks about how optimizing the customer journey through your mobile app can help you optimize your call center.
FileTSAR: Free digital forensic investigations toolkit for law enforcement
Purdue University cybersecurity experts have created FileTSAR, an all-in-one digital forensic investigations toolkit for law enforcement.
WPA3 design flaws affect security of new Wi-Fi standard
Researchers have discovered a number of design flaws affecting the security of the recently introduced WPA3 data transmission protocol.
CIOs and CISOs hold off on crucial updates due to potential impact on business operations
CIOs and CISOs around the world have held back from implementing critical measures that keep them resilient against disruption and cyber threats.
WikiLeaks’ Julian Assange arrested in London
Wikileaks founder Julian Assange has been arrested by officers of the Metropolitan Police at the Embassy of Ecuador in London.
Enterprise VPN apps store authentication and session cookies insecurely
CVE-2019-1573, a flaw that makes VPN applications store the authentication and/or session cookies insecurely (i.e. unencrypted) in memory and/or log files, affects a yet to be determined number of enterprise Virtual Private Network (VPN) applications.
Insights gained from working on more than 750 cybersecurity incidents
Many entities face the same security risks so it is essential to have an insight on how to manage them and respond in case of occurrence.
How password-less security benefits helpdesks
As the list of helpdesk tasks continues to grow, IT teams can improve efficiency and effectiveness by making changes to eliminate some of the most mundane and time-consuming tasks. Chief among these are password resets.
TRITON attackers detected at another critical infrastructure facility
The attackers who were first spotted wielding the custom TRITON framework have targeted another critical infrastructure facility, FireEye researchers have revealed.
April 2019 Patch Tuesday: Microsoft fixes two actively exploited bugs
Microsoft has plugged 74 CVE-numbered security including two vulnerabilities actively exploited by attackers. All of the bugs are rated either Critical or Important.
Windows 10: New update controls for end users, automatic removal of broken updates
It seems that last year’s Windows 10 updating troubles have spurred Microsoft to make some changes to the operating system’s update experience and the company’s quality testing of updates.
PoC exploit for Carpe Diem Apache bug released
Charles Fol, the security engineer that unearthed the Carpe Diem Apache HTTP Server bug (CVE-2019-0211), has released an exploit for it.
Hacking healthcare: A call for infosec researchers to probe biomedical devices
With innovative attacks against a variety of biomedical devices being demonstrated seemingly every day, ransomware attacks might end up to be the least of our and the healthcare industry’s problems.
90% of OT organizations are cyberattack victims, yet visibility into OT systems is still limited
90% of OT organizations stated their environments had been damaged by at least one cyberattack over the past two years, with 62% experiencing two or more attacks.
Regulating the IoT: Impact and new considerations for cybersecurity and new government regulations
In 2019 we have reached a new turning point in the adoption of IoT – more markets and industries are migrating to a cloud-based infrastructure, and as the IoT continues to gain popularity and more devices and data move online, lawmakers and legislators around the globe are taking note.
Perimeter solutions: Do layers of security make a difference?
As an enterprise, it is always important to constantly reevaluate information security solutions. When doing so, take a good look at the perimeter solutions in place and their associated detection mechanisms.
Is your organization getting physical security right?
For most organizations (and especially for tech companies), the physical security of data centers and headquarters is of the utmost importance.
Adhering to the mobility requirements of NIST 800-171 does not have to keep you awake at night
The majority of companies in the United States and Europe are required to comply with at least one IT security regulation – often times more. This forces companies to exert strong control over how data is transferred, accessed and maintained throughout its lifecycle.
The unique business-critical threats facing converged IT-OT systems
Manufacturers are heavily investing in the convergence of traditional operational technology (OT) with IT networks in 2019, adding new technology to environments that are still vulnerable to more than 10-year-old issues, like Conficker.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/04/14/week-in-review-password-less-security-wpa3-design-flaws-new-windows-10-update-controls/